High severity8.8NVD Advisory· Published Oct 16, 2018· Updated Jun 17, 2026

CVE-2018-18382

Description

Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Advanced Hrminferred
Range: <=1.6
Package: https://wordpress.org/plugins/advanced-hrm
Advanced HRM/Advanced HRMllm-create
Range: <=1.6

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/45604/nvdExploitThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000